MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9f13cf27020a8a93b1080cc47bc991fd848fde4736a0f776556eff6c1f68f5e7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NanoCore


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9f13cf27020a8a93b1080cc47bc991fd848fde4736a0f776556eff6c1f68f5e7
SHA3-384 hash: c2acb8fff509acf4874621cf68b3d8b56256e2816cb18bdb6ab8054fba713dda353d45ecc8ec434021a1118206c26dad
SHA1 hash: e5f9d4086dc13b7ead97419682ab799b6058c930
MD5 hash: 27c452534617dc2cd8c4189afdb0575f
humanhash: lake-pip-maryland-sodium
File name:Payment Slip.zip
Download: download sample
Signature NanoCore
Create hunting rule
File size:160'332 bytes
First seen:2020-10-09 06:35:42 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 3072:a2AafnDu/nGcRu/FdHabEP+1huCf/pmhP8T96pF6CNRl28YaF9KlnxmfIMFl7xqo:DAOnDufGciBGhlT9a6Cvvr5fI2xt
TLSH B7F312605EACA42B391AAD0813821160C81A1A632FA04F4155E5716DDFDDFDE3F3FA2F
Reporter abuse_ch
Tags:NanoCore RAT zip


Avatar
abuse_ch
Malspam distributing NanoCore:

HELO: expressnet1.info
Sending IP: 103.114.218.159
From: info@expressnet1.info
Subject: Payment Confirmation Slip copy $75,....
Attachment: Payment Slip.zip (contains "Payment Slip.exe")

NanoCore RAT C2:
kene321.ddns.net:3231

Intelligence

File Origin
# of uploads :
1
# of downloads :
123
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/9f13cf27020a8a93b1080cc47bc991fd848fde4736a0f776556eff6c1f68f5e7/
Threat name:
ByteCode-MSIL.Backdoor.NanoCore
Create hunting rule
Status:
Malicious
First seen:
2020-10-08 21:07:53 UTC
AV detection:
38 of 48 (79.17%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=t4j46jycbkfjhmiibtchxsmr7wci7xshg2qpo5svn37wyh3i6xtq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Nanocore
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/9f13cf27020a8a93b1080cc47bc991fd848fde4736a0f776556eff6c1f68f5e7

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

NanoCore

zip 9f13cf27020a8a93b1080cc47bc991fd848fde4736a0f776556eff6c1f68f5e7

(this sample)

NanoCore

Executable exe bdf417ea1e842e773dc186d3554f69531adc81c81d6f079bae570ba20138f586

  
Dropping
MD5 edcc289d283831f4cbd7c6e08e840275
  
Dropping
NanoCore
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 bdf417ea1e842e773dc186d3554f69531adc81c81d6f079bae570ba20138f586

Comments